@forge/csp 4.1.0-next.2 → 4.2.0-next.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +17 -0
  2. package/out/csp/csp-injection-service.d.ts +9 -3
  3. package/out/csp/csp-injection-service.d.ts.map +1 -1
  4. package/out/csp/csp-injection-service.js +143 -126
  5. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -1,5 +1,22 @@
1
1
  # @forge/csp
2
2
 
3
+ ## 4.2.0-next.0
4
+
5
+ ### Minor Changes
6
+
7
+ - cfde21e: Add CSP Urls for IC environment
8
+
9
+ ## 4.1.0
10
+
11
+ ### Minor Changes
12
+
13
+ - effab31: Bumped cheerio from 0.22 to 1.1
14
+
15
+ ### Patch Changes
16
+
17
+ - 195411c: patch dependencies
18
+ - f5ba3aa: Allow-list Atlassian media URLs by default for media CSP policies
19
+
3
20
  ## 4.1.0-next.2
4
21
 
5
22
  ### Minor Changes
package/out/csp/csp-injection-service.d.ts CHANGED
@@ -1,21 +1,27 @@
1
1
  import type { LambdaEnvironment } from '@forge/cli-shared';
2
2
  import { CSPDetails } from '../types';
3
- export declare const ATLASSIAN_IMAGES_HOSTS: {
4
- [microsEnv in LambdaEnvironment]: string[];
3
+ declare type IcOptions = {
4
+ icLabel: string;
5
+ serviceName: string;
5
6
  };
7
+ export declare const getAtlassianImageHost: (microsEnv: LambdaEnvironment, icOptions?: IcOptions) => string[];
6
8
  export declare const EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS: string[];
7
9
  export declare class CSPInjectionService {
10
+ private isIsolatedContext;
8
11
  private getCSPReportUri;
9
12
  private getForgeGlobalCSP;
13
+ private getMetalClientCSP;
10
14
  private getExistingCSPDetails;
11
15
  private getConnectSrc;
12
16
  private getFrameAncestors;
13
- getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP }: {
17
+ getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions }: {
14
18
  existingCSPDetails: CSPDetails;
15
19
  microsEnv: LambdaEnvironment;
16
20
  tunnelCSPReporterUri?: string | undefined;
17
21
  hostname?: string | undefined;
18
22
  isFedRAMP?: boolean | undefined;
23
+ icOptions?: IcOptions | undefined;
19
24
  }) => string[];
20
25
  }
26
+ export {};
21
27
  //# sourceMappingURL=csp-injection-service.d.ts.map
package/out/csp/csp-injection-service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AA2DvD,eAAO,MAAM,sBAAsB,EAAE;KAAG,SAAS,IAAI,iBAAiB,GAAG,MAAM,EAAE;CA8ChF,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,iBAAiB;IAoClB,gBAAgB;4BAOD,UAAU;mBACnB,iBAAiB;;;;UAI1B,MAAM,EAAE,CA8DV;CACH"}
1
+ {"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,SAAS,GAAG;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AA6FF,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAUjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAqBrB,OAAO,CAAC,iBAAiB;IAiDlB,gBAAgB;4BAQD,UAAU;mBACnB,iBAAiB;;;;;UAK1B,MAAM,EAAE,CA8DV;CACH"}
package/out/csp/csp-injection-service.js CHANGED
@@ -1,155 +1,172 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.CSPInjectionService = exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = exports.ATLASSIAN_IMAGES_HOSTS = void 0;
3
+ exports.CSPInjectionService = exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = exports.getAtlassianImageHost = void 0;
4
4
  const types_1 = require("../types");
5
- const ATLASSIAN_API_GATEWAY_HOST = {
6
- dev: 'https://api.dev.atlassian.com',
7
- stg: 'https://api.stg.atlassian.com',
8
- prod: 'https://api.atlassian.com',
9
- 'fedramp-stg': 'https://api.stg.atlassian-us-gov-mod.com',
10
- 'fedramp-prod': 'https://api.atlassian-us-gov-mod.com'
11
- };
12
- const ATLASSIAN_MEDIA_GATEWAY_HOST = {
13
- dev: 'https://media.dev.atl-paas.net',
14
- stg: 'https://media.staging.atl-paas.net',
15
- prod: 'https://api.media.atlassian.com',
16
- 'fedramp-stg': 'https://api-media.stg.atlassian-us-gov-mod.com',
17
- 'fedramp-prod': 'https://api-media.atlassian-us-gov-mod.com'
18
- };
19
- const ATLASSIAN_AVATAR_HOST = {
20
- dev: 'avatar-management--avatars.us-west-2.staging.public.atl-paas.net',
21
- stg: 'avatar-management--avatars.us-west-2.staging.public.atl-paas.net',
22
- prod: 'avatar-management--avatars.us-west-2.prod.public.atl-paas.net',
23
- 'fedramp-stg': 'avatar-management--avatars.us-east-1.staging.cdn.atlassian-us-gov-mod.com',
24
- 'fedramp-prod': 'avatar-management--avatars.us-east-1.prod.cdn.atlassian-us-gov-mod.com'
25
- };
26
- const ATLASSIAN_TEAM_HEADER_HOST = {
27
- dev: 'https://ptc-directory-sited-static.us-east-1.staging.public.atl-paas.net/gradients/',
28
- stg: 'https://ptc-directory-sited-static.us-east-1.staging.public.atl-paas.net/gradients/',
29
- prod: 'https://ptc-directory-sited-static.us-east-1.prod.public.atl-paas.net/gradients/',
30
- 'fedramp-stg': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/',
31
- 'fedramp-prod': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/'
32
- };
33
- const ATLASSIAN_TEAM_AVATAR_HOST = {
34
- dev: 'https://teams-directory-frontend.stg-east.frontend.public.atl-paas.net/assets/',
35
- stg: 'https://teams-directory-frontend.stg-east.frontend.public.atl-paas.net/assets/',
36
- prod: 'https://teams-directory-frontend.prod-east.frontend.public.atl-paas.net/assets/',
37
- 'fedramp-stg': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/',
38
- 'fedramp-prod': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/'
5
+ const ATLASSIAN_HOST = {
6
+ ATLASSIAN_API_GATEWAY_HOST: {
7
+ dev: 'https://api.dev.atlassian.com',
8
+ stg: 'https://api.stg.atlassian.com',
9
+ prod: 'https://api.atlassian.com',
10
+ 'fedramp-stg': 'https://api.stg.atlassian-us-gov-mod.com',
11
+ 'fedramp-prod': 'https://api.atlassian-us-gov-mod.com',
12
+ 'ic-stg': (_icOptions) => 'https://api.pear.oasis-stg.com',
13
+ 'ic-prod': ({ icLabel }) => `https://api.${icLabel}.atlassian-isolated.net`
14
+ },
15
+ ATLASSIAN_MEDIA_GATEWAY_HOST: {
16
+ dev: 'https://media.dev.atl-paas.net',
17
+ stg: 'https://media.staging.atl-paas.net',
18
+ prod: 'https://api.media.atlassian.com',
19
+ 'fedramp-stg': 'https://api-media.stg.atlassian-us-gov-mod.com',
20
+ 'fedramp-prod': 'https://api-media.atlassian-us-gov-mod.com',
21
+ 'ic-stg': (_icOptions) => 'https://media-api.pear.oasis-stg.com',
22
+ 'ic-prod': ({ icLabel }) => `https://media-api.${icLabel}.atlassian-isolated.net`
23
+ },
24
+ ATLASSIAN_AVATAR_HOST: {
25
+ dev: 'avatar-management--avatars.us-west-2.staging.public.atl-paas.net',
26
+ stg: 'avatar-management--avatars.us-west-2.staging.public.atl-paas.net',
27
+ prod: 'avatar-management--avatars.us-west-2.prod.public.atl-paas.net',
28
+ 'fedramp-stg': 'avatar-management--avatars.us-east-1.staging.cdn.atlassian-us-gov-mod.com',
29
+ 'fedramp-prod': 'avatar-management--avatars.us-east-1.prod.cdn.atlassian-us-gov-mod.com',
30
+ 'ic-stg': (_icOptions) => 'avatar-management--avatars.us-west-2.staging.public.atl-paas.net',
31
+ 'ic-prod': ({ icLabel }) => 'avatar-management--avatars.us-west-2.prod.public.atl-paas.net'
32
+ },
33
+ ATLASSIAN_TEAM_HEADER_HOST: {
34
+ dev: 'https://ptc-directory-sited-static.us-east-1.staging.public.atl-paas.net/gradients/',
35
+ stg: 'https://ptc-directory-sited-static.us-east-1.staging.public.atl-paas.net/gradients/',
36
+ prod: 'https://ptc-directory-sited-static.us-east-1.prod.public.atl-paas.net/gradients/',
37
+ 'fedramp-stg': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/',
38
+ 'fedramp-prod': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/',
39
+ 'ic-stg': (_icOptions) => 'https://teams-directory-frontend.services.pear.oasis-stg.com/bfa/',
40
+ 'ic-prod': ({ icLabel }) => `https://teams-directory-frontend.services.${icLabel}.atlassian-isolated.net/bfa/`
41
+ },
42
+ ATLASSIAN_TEAM_AVATAR_HOST: {
43
+ dev: 'https://teams-directory-frontend.stg-east.frontend.public.atl-paas.net/assets/',
44
+ stg: 'https://teams-directory-frontend.stg-east.frontend.public.atl-paas.net/assets/',
45
+ prod: 'https://teams-directory-frontend.prod-east.frontend.public.atl-paas.net/assets/',
46
+ 'fedramp-stg': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/',
47
+ 'fedramp-prod': 'https://teams-directory-frontend.frontend.cdn.atlassian-us-gov-mod.com/assets/',
48
+ 'ic-stg': (_icOptions) => 'https://teams-directory-frontend.services.pear.oasis-stg.com/bfa/',
49
+ 'ic-prod': ({ icLabel }) => `https://teams-directory-frontend.services.${icLabel}.atlassian-isolated.net/bfa/`
50
+ },
51
+ ATLASSIAN_EMOJIS_HOST: {
52
+ dev: 'https://pf-emoji-service--cdn.ap-southeast-2.dev.public.atl-paas.net',
53
+ stg: 'https://pf-emoji-service--cdn.us-east-1.staging.public.atl-paas.net',
54
+ prod: 'https://pf-emoji-service--cdn.us-east-1.prod.public.atl-paas.net',
55
+ 'fedramp-stg': 'https://pf-emoji-service--cdn.us-east-1.staging.cdn.atlassian-us-gov-mod.com',
56
+ 'fedramp-prod': 'https://pf-emoji-service--cdn.us-east-1.prod.cdn.atlassian-us-gov-mod.com',
57
+ 'ic-stg': (_icOptions) => 'https://pf-emoji-service.pear.oasis-stg.com',
58
+ 'ic-prod': ({ icLabel }) => `https://pf-emoji-service.${icLabel}.atlassian-isolated.net`
59
+ }
39
60
  };
40
- const ATLASSIAN_EMOJIS_HOST = {
41
- dev: 'https://pf-emoji-service--cdn.ap-southeast-2.dev.public.atl-paas.net',
42
- stg: 'https://pf-emoji-service--cdn.us-east-1.staging.public.atl-paas.net',
43
- prod: 'https://pf-emoji-service--cdn.us-east-1.prod.public.atl-paas.net',
44
- 'fedramp-stg': 'https://pf-emoji-service--cdn.us-east-1.staging.cdn.atlassian-us-gov-mod.com',
45
- 'fedramp-prod': 'https://pf-emoji-service--cdn.us-east-1.prod.cdn.atlassian-us-gov-mod.com'
61
+ const getAtlassianHost = (hostType, microsEnv, icOptions) => {
62
+ const hostMap = ATLASSIAN_HOST[hostType];
63
+ if (microsEnv === 'ic-prod' || microsEnv === 'ic-stg') {
64
+ if (!icOptions) {
65
+ throw new Error('Missing IC label');
66
+ }
67
+ return hostMap[microsEnv](icOptions);
68
+ }
69
+ return hostMap[microsEnv];
46
70
  };
47
- exports.ATLASSIAN_IMAGES_HOSTS = {
48
- dev: [
49
- `https://${ATLASSIAN_AVATAR_HOST['dev']}`,
50
- `https://*.wp.com/${ATLASSIAN_AVATAR_HOST['dev']}/`,
51
- ATLASSIAN_API_GATEWAY_HOST['dev'],
52
- ATLASSIAN_MEDIA_GATEWAY_HOST['dev'],
53
- ATLASSIAN_EMOJIS_HOST['dev'],
54
- ATLASSIAN_TEAM_AVATAR_HOST['dev'],
55
- ATLASSIAN_TEAM_HEADER_HOST['dev']
56
- ],
57
- stg: [
58
- `https://${ATLASSIAN_AVATAR_HOST['stg']}`,
59
- `https://*.wp.com/${ATLASSIAN_AVATAR_HOST['stg']}/`,
60
- ATLASSIAN_API_GATEWAY_HOST['stg'],
61
- ATLASSIAN_MEDIA_GATEWAY_HOST['stg'],
62
- ATLASSIAN_EMOJIS_HOST['stg'],
63
- ATLASSIAN_TEAM_AVATAR_HOST['stg'],
64
- ATLASSIAN_TEAM_HEADER_HOST['stg']
65
- ],
66
- prod: [
67
- `https://${ATLASSIAN_AVATAR_HOST['prod']}`,
68
- `https://*.wp.com/${ATLASSIAN_AVATAR_HOST['prod']}/`,
69
- ATLASSIAN_API_GATEWAY_HOST['prod'],
70
- ATLASSIAN_MEDIA_GATEWAY_HOST['prod'],
71
- ATLASSIAN_EMOJIS_HOST['prod'],
72
- ATLASSIAN_TEAM_AVATAR_HOST['prod'],
73
- ATLASSIAN_TEAM_HEADER_HOST['prod']
74
- ],
75
- 'fedramp-stg': [
76
- `https://${ATLASSIAN_AVATAR_HOST['fedramp-stg']}`,
77
- `https://*.wp.com/${ATLASSIAN_AVATAR_HOST['fedramp-stg']}/`,
78
- ATLASSIAN_API_GATEWAY_HOST['fedramp-stg'],
79
- ATLASSIAN_MEDIA_GATEWAY_HOST['fedramp-stg'],
80
- ATLASSIAN_EMOJIS_HOST['fedramp-stg'],
81
- ATLASSIAN_TEAM_AVATAR_HOST['fedramp-stg'],
82
- ATLASSIAN_TEAM_HEADER_HOST['fedramp-stg']
83
- ],
84
- 'fedramp-prod': [
85
- `https://${ATLASSIAN_AVATAR_HOST['fedramp-prod']}`,
86
- `https://*.wp.com/${ATLASSIAN_AVATAR_HOST['fedramp-prod']}/`,
87
- ATLASSIAN_API_GATEWAY_HOST['fedramp-prod'],
88
- ATLASSIAN_MEDIA_GATEWAY_HOST['fedramp-prod'],
89
- ATLASSIAN_EMOJIS_HOST['fedramp-prod'],
90
- ATLASSIAN_TEAM_AVATAR_HOST['fedramp-prod'],
91
- ATLASSIAN_TEAM_HEADER_HOST['fedramp-prod']
92
- ]
71
+ const getAtlassianImageHost = (microsEnv, icOptions) => {
72
+ return [
73
+ `https://${getAtlassianHost('ATLASSIAN_AVATAR_HOST', microsEnv, icOptions)}`,
74
+ `https://*.wp.com/${getAtlassianHost('ATLASSIAN_AVATAR_HOST', microsEnv, icOptions)}/`,
75
+ getAtlassianHost('ATLASSIAN_API_GATEWAY_HOST', microsEnv, icOptions),
76
+ getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions),
77
+ getAtlassianHost('ATLASSIAN_EMOJIS_HOST', microsEnv, icOptions),
78
+ getAtlassianHost('ATLASSIAN_TEAM_AVATAR_HOST', microsEnv, icOptions),
79
+ getAtlassianHost('ATLASSIAN_TEAM_HEADER_HOST', microsEnv, icOptions)
80
+ ];
93
81
  };
82
+ exports.getAtlassianImageHost = getAtlassianImageHost;
94
83
  exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = ['https://secure.gravatar.com', 'https://images.unsplash.com'];
95
84
  class CSPInjectionService {
96
- getCSPReportUri(microsEnv) {
85
+ isIsolatedContext(microsEnv, icOptions) {
86
+ return microsEnv.startsWith('ic') && !!icOptions;
87
+ }
88
+ getCSPReportUri(microsEnv, icOptions) {
89
+ const serviceName = this.isIsolatedContext(microsEnv, icOptions) ? icOptions.serviceName : 'forge-cdn';
97
90
  if (microsEnv === 'dev' || microsEnv === 'stg')
98
- return 'https://web-security-reports.stg.services.atlassian.com/csp-report/forge-cdn';
99
- return 'https://web-security-reports.services.atlassian.com/csp-report/forge-cdn';
91
+ return `https://web-security-reports.stg.services.atlassian.com/csp-report/${serviceName}`;
92
+ return `https://web-security-reports.services.atlassian.com/csp-report/${serviceName}`;
100
93
  }
101
- getForgeGlobalCSP(microsEnv, isFedRAMP = false) {
94
+ getForgeGlobalCSP(microsEnv, isFedRAMP = false, icOptions) {
95
+ if (this.isIsolatedContext(microsEnv, icOptions)) {
96
+ return microsEnv === 'ic-stg'
97
+ ? 'https://forge.forge-cdn.pear.oasis-stg.com'
98
+ : `https://forge.forge-cdn.${icOptions.icLabel}.atlassian-isolated.net`;
99
+ }
102
100
  return isFedRAMP
103
101
  ? `https://forge.cdn.${microsEnv.split('-')[1]}.atlassian-dev-us-gov-mod.net`
104
102
  : `https://forge.cdn.${microsEnv}.atlassian-dev.net`;
105
103
  }
104
+ getMetalClientCSP(microsEnv, icOptions) {
105
+ if (this.isIsolatedContext(microsEnv, icOptions)) {
106
+ return microsEnv === 'ic-stg'
107
+ ? 'https://api.pear.oasis-stg/metal/ingest'
108
+ : `https://api.${icOptions.icLabel}.atlassian-isolated.net/metal/ingest`;
109
+ }
110
+ return `https://api.${microsEnv === 'prod' ? '' : 'stg.'}atlassian.com/metal/ingest`;
111
+ }
106
112
  getExistingCSPDetails(cspType, cspDetails) {
107
113
  return cspDetails[cspType] ?? [];
108
114
  }
109
- getConnectSrc(microsEnv, isTunnelling) {
115
+ getConnectSrc(microsEnv, isTunnelling, icOptions) {
110
116
  const allowed = [];
111
117
  if (isTunnelling) {
112
118
  allowed.push(...['ws://localhost:*', 'http://localhost:*']);
113
119
  }
114
- allowed.push(`https://api.${microsEnv === 'prod' ? '' : 'stg.'}atlassian.com/metal/ingest`);
115
- allowed.push(`${ATLASSIAN_API_GATEWAY_HOST[microsEnv]}/gateway/api/emoji/`);
116
- allowed.push(ATLASSIAN_MEDIA_GATEWAY_HOST[microsEnv]);
120
+ const metalClientCSP = this.getMetalClientCSP(microsEnv, icOptions);
121
+ allowed.push(metalClientCSP);
122
+ allowed.push(`${getAtlassianHost('ATLASSIAN_API_GATEWAY_HOST', microsEnv, icOptions)}/gateway/api/emoji/`);
123
+ allowed.push(getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions));
117
124
  return allowed;
118
125
  }
119
126
  getFrameAncestors(microsEnv, hostname) {
120
127
  let frameAncestors = [];
121
- if (microsEnv === 'dev' || microsEnv === 'stg') {
122
- frameAncestors = [
123
- '*.jira-dev.com',
124
- 'http://localhost:*',
125
- 'http://devbucket.localhost',
126
- 'https://integration.bb-inf.net',
127
- '*.atl-paas.net',
128
- '*.stg.atlassian.com'
129
- ];
130
- }
131
- else if (microsEnv === 'fedramp-stg') {
132
- frameAncestors = ['*.atlassian-stg-fedm.net'];
133
- }
134
- else if (microsEnv === 'fedramp-prod') {
135
- frameAncestors = ['*.atlassian-us-gov-mod.net'];
136
- }
137
- else {
138
- frameAncestors = [
139
- '*.atlassian.net',
140
- 'bitbucket.org',
141
- '*.jira.com',
142
- '*.atlassian.com',
143
- '*.frontend.public.atl-paas.net'
144
- ];
128
+ switch (microsEnv) {
129
+ case 'dev':
130
+ case 'stg':
131
+ frameAncestors = [
132
+ '*.jira-dev.com',
133
+ 'http://localhost:*',
134
+ 'http://devbucket.localhost',
135
+ 'https://integration.bb-inf.net',
136
+ '*.atl-paas.net',
137
+ '*.stg.atlassian.com'
138
+ ];
139
+ break;
140
+ case 'fedramp-stg':
141
+ frameAncestors = ['*.atlassian-stg-fedm.net'];
142
+ break;
143
+ case 'fedramp-prod':
144
+ frameAncestors = ['*.atlassian-us-gov-mod.net'];
145
+ break;
146
+ case 'ic-stg':
147
+ frameAncestors = ['*.oasis-stg.com'];
148
+ break;
149
+ case 'ic-prod':
150
+ frameAncestors = ['*.atlassian-isolated.net'];
151
+ break;
152
+ case 'prod':
153
+ default:
154
+ frameAncestors = [
155
+ '*.atlassian.net',
156
+ 'bitbucket.org',
157
+ '*.jira.com',
158
+ '*.atlassian.com',
159
+ '*.frontend.public.atl-paas.net'
160
+ ];
161
+ break;
145
162
  }
146
163
  if (hostname) {
147
164
  frameAncestors.push(hostname);
148
165
  }
149
166
  return frameAncestors;
150
167
  }
151
- getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP }) => {
152
- const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv);
168
+ getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions }) => {
169
+ const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv, icOptions);
153
170
  const defaultSrc = `'self'`;
154
171
  const frameAncestors = ["'self'", ...this.getFrameAncestors(microsEnv, hostname)].join(' ');
155
172
  const frameSrc = ["'self'", hostname, ...this.getExistingCSPDetails(types_1.ExternalCspType.FRAME_SRC, existingCSPDetails)]
@@ -162,7 +179,7 @@ class CSPInjectionService {
162
179
  'blob:',
163
180
  hostname,
164
181
  ...exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS,
165
- ...exports.ATLASSIAN_IMAGES_HOSTS[microsEnv],
182
+ ...(0, exports.getAtlassianImageHost)(microsEnv, icOptions),
166
183
  ...this.getExistingCSPDetails(types_1.ExternalCspType.IMG_SRC, existingCSPDetails)
167
184
  ]
168
185
  .filter((a) => a)
@@ -172,24 +189,24 @@ class CSPInjectionService {
172
189
  'data:',
173
190
  'blob:',
174
191
  hostname,
175
- ATLASSIAN_MEDIA_GATEWAY_HOST[microsEnv],
192
+ getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions),
176
193
  ...this.getExistingCSPDetails(types_1.ExternalCspType.MEDIA_SRC, existingCSPDetails)
177
194
  ]
178
195
  .filter((a) => a)
179
196
  .join(' ');
180
197
  const connectSrc = [
181
198
  "'self'",
182
- ...this.getConnectSrc(microsEnv, !!tunnelCSPReporterUri),
199
+ ...this.getConnectSrc(microsEnv, !!tunnelCSPReporterUri, icOptions),
183
200
  ...this.getExistingCSPDetails(types_1.ExternalCspType.CONNECT_SRC, existingCSPDetails)
184
201
  ].join(' ');
185
202
  const scriptSrc = [
186
203
  "'self'",
187
- this.getForgeGlobalCSP(microsEnv, isFedRAMP),
204
+ this.getForgeGlobalCSP(microsEnv, isFedRAMP, icOptions),
188
205
  ...this.getExistingCSPDetails(types_1.ExternalCspType.SCRIPT_SRC, existingCSPDetails)
189
206
  ].join(' ');
190
207
  const styleSrc = [
191
208
  "'self'",
192
- this.getForgeGlobalCSP(microsEnv, isFedRAMP),
209
+ this.getForgeGlobalCSP(microsEnv, isFedRAMP, icOptions),
193
210
  ...this.getExistingCSPDetails(types_1.ExternalCspType.STYLE_SRC, existingCSPDetails)
194
211
  ].join(' ');
195
212
  return [
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@forge/csp",
3
- "version": "4.1.0-next.2",
3
+ "version": "4.2.0-next.0",
4
4
  "description": "Contains the CSP configuration for Custom UI resources in Forge",
5
5
  "main": "out/index.js",
6
6
  "author": "Atlassian",
@@ -11,8 +11,8 @@
11
11
  "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
12
12
  },
13
13
  "devDependencies": {
14
- "@forge/cli-shared": "8.1.0-next.9",
15
- "@forge/manifest": "10.1.0-next.9",
14
+ "@forge/cli-shared": "8.2.0-next.10",
15
+ "@forge/manifest": "10.1.1-next.2",
16
16
  "@types/jest": "^29.5.14",
17
17
  "@types/node": "20.19.1"
18
18
  },